Directory Information: The Most Commonly Misunderstood Part of FERPA

Ask ten district staff members what "directory information" means under FERPA and you'll get ten slightly different answers. Ask them whether publishing student information is allowed under the directory-information exception, and the most common answer is some version of "probably, if we put it in the annual notice."

That answer is partially right. It's also the reason directory-information mishandling is one of the most frequent categories of FERPA exposure that privacy compliance scans surface.

What Directory Information Actually Is

The Family Educational Rights and Privacy Act (FERPA) generally requires written consent before a school shares personally identifiable information from a student's education records. Directory information is a narrow exception to that rule.

Under 34 CFR § 99.3 and § 99.37, a school may designate certain categories of information as directory information and share them without consent, provided the school:

• Gives parents and eligible students public notice of the categories designated as directory information
• Gives parents and eligible students a reasonable period of time to refuse (opt out)
• Does not disclose directory information about students whose parents or eligible students have opted out

Categories of information that may be designated as directory information include the student's name, address, telephone number, email address, photograph, date and place of birth, major field of study, dates of attendance, grade level, enrollment status, participation in activities and sports, weight and height of members of athletic teams, degrees and awards received, and the most recent school attended.

The Four Places Districts Go Wrong

Mistake 1: Treating the List as Automatic

The items listed in 34 CFR § 99.3 are the items a school may designate. They are not automatically directory information. A school has to actively designate them in the annual notice.

If a district's annual notice designates only "name, grade level, and dates of attendance" as directory information, then publishing a student's phone number on a school directory is not covered by the exception — even though phone numbers are in the federal list of items that could be designated. Scanning engines routinely find this exact issue: phone numbers and email addresses on school directories when the district's own notice only covered name and grade.

Mistake 2: Confusing "Public" With "Directory"

Some districts assume that information is directory information because it "feels public" — things like sports team rosters, honor rolls, or yearbook photos. That's not how the rule works. If the item isn't in the annual notice as designated directory information, it isn't covered. Publishing a varsity soccer roster with jersey numbers, hometowns, and graduation years may look routine, but if "participation in sports" and "home address" aren't designated, the publication is a potential violation.

Mistake 3: Ignoring Opt-Outs

Even when directory information is properly designated, parents and eligible students have the right to opt out. The district is responsible for honoring those opt-outs across all publications. This is harder than it sounds, because:

• Opt-out records are usually kept in the student information system (SIS)
• Publications are managed by communications staff, coaches, teachers, and athletic directors
• Nothing automatically checks the SIS before a name goes into a public post

In practice, a coach posts an honor roll for the varsity team. The list includes a student whose family has opted out of directory disclosures. The coach didn't know, nobody flagged it, and the student's name is now on the district's public website. This is one of the more painful categories of FERPA violation because it's invisible to everyone except the family that opted out.

Mistake 4: Combining Directory Info With Protected Info

Directory information is only exempt from consent requirements when disclosed by itself. The moment it's combined with information that requires consent — like grades, disciplinary records, or special education status — the exception no longer applies.

Publishing "John Doe, 10th grade, honor roll" is generally fine if those items are designated. Publishing "John Doe, 10th grade, honor roll, receiving special education services" is not. The "receiving special education services" piece is protected information, and combining it with identifying details creates a disclosure that requires consent regardless of what the annual notice says.

The Surprisingly Easy Fix

Districts that avoid directory-information problems tend to follow four practices:

1. Keep the Designation Tight

Only designate the categories the district actually uses for public purposes. If you don't publish student phone numbers anywhere, don't designate them. A short designation list is easier to comply with.

2. Document the Designation Clearly

The annual notice should list, in plain language, exactly what has been designated. Ambiguity creates exposure. "Student names and grade levels" is clear. "Customary directory information" is not.

3. Make Opt-Outs Easy to Honor

The district should have a single authoritative list of students whose families have opted out, and every staff member who publishes student names should know how to check it. Some districts flag opt-outs directly in the SIS and train staff to run a check before publishing rosters or honor rolls.

4. Audit Against the Designation

Periodically — at least annually — audit the district's public web presence against the current directory-information designation. Anything outside the designation either needs to be removed, or needs consent. Automated scans can do most of this work.

The Real Purpose of the Rule

The directory-information exception exists so that schools can function. Recognizing students for achievements, celebrating athletic teams, listing honor-roll recipients, and publishing yearbook photos are core parts of community life. FERPA's drafters didn't want to require written consent for every instance of a student's name appearing anywhere.

But the exception was deliberately narrow. It requires notice, allows opt-outs, and applies only to designated categories. Districts that treat it as a blanket permission slip — "we can publish anything because there's a directory-information exception" — inevitably run afoul of the rule.

Getting directory information right isn't hard. It just requires precision: a clear designation, a reliable opt-out process, and a periodic check against what's actually being published.